PCI DSS v4.0.1
Security standard of the payment card industry for every system that stores, processes or transmits card data. Merchants, payment service providers and any company whose website or systems touch card payments.
9 controls supported. References are PCI DSS requirement numbers; titles are our own summaries.
Our services support these controls and produce evidence for them. Certification depends on your whole management system and is granted by an accredited auditor, not by a supplier.
Mapping under review
- Control
- 10.2.1Audit logs enabled and active
- 10.5.1Audit log history kept for at least twelve months
- How we help
- Logpush sends every request, security event and access decision to storage you control, such as R2, retained for twelve months or more.
- Evidence you get
- Logpush job inventory, retention settings, sample log queries.
Mapping under review
- Control
- 4.2.1Strong cryptography for card data over public networks
- 6.4.2Automated protection of public-facing web applications
- 6.4.3Inventory and authorisation of payment page scripts
- 11.6.1Detection of unauthorised changes to payment pages
- How we help
- Cloudflare WAF is the automated solution in front of your public web applications, TLS is enforced at the edge, and Page Shield keeps an inventory of the scripts on your payment pages and alerts on unauthorised changes.
- Evidence you get
- WAF configuration and blocked-attack reports, TLS settings, Page Shield script inventory and change alerts.
Mapping under review
- Control
- 1.3.1Inbound traffic to the card data environment restricted
- 7.2.1Access granted by role and need to know
- 8.4.2Multi-factor authentication for access to the card data environment
- How we help
- Systems in the card data environment are reachable only through Cloudflare Access, per role and with multi-factor authentication, with no inbound ports open to the internet.
- Evidence you get
- Access policy export, authentication logs, tunnel configuration.
Tell us what you are preparing for
We reply with the controls we can cover, what stays on your side, and a realistic timeline.